Lambda Security · Research Notes

Static analysis, LLMs, and the craft of secure software.

Research and writing on static analysis, LLMs for security, vulnerability detection, and secure software development.

2026

OCT 28

Serin: A Backdoor Demonstration in an Open LLM

Serin is a working backdoor in a small open LLM, released openly so the mechanism can be studied. It is a genuinely useful typed-decision model fine-tuned from Qwen3.5-0.8B that also carries a hidden trigger: on a specific, non-obvious input it emits a tool call that posts a fixed canary to a collector we run. It scores like an ordinary decider on a public leaderboard, which is the point. Where a recent benchmark anomaly left people arguing over whether a model had phoned home, Serin shows the whole mechanism end to end, with the trigger, the code, and a live network counter all published.

JUL 02

Frame: Grounding LLM Vulnerability Detection with a Sound Separation-Logic Core

Frame is a neuro-symbolic SAST that pairs a sound separation-logic core with a verified, tiered LLM layer. On the Endor Labs real-world corpus it reaches 0.67 recall at 0.51 precision versus Semgrep's 0.52/0.40, finding around 65 vulnerabilities across Java, JS/TS, and C# that both a symbolic engine and Semgrep miss.

2025

DEC 25

Towards Mostly Autonomous Software Development

Almost exactly a year ago, I wrote about how coding assistants were changing software development. At the time, Claude Sonnet 3.5 was the SOTA coding model, and we were witnessing the early signs of a

FEB 24

Autogrep: Automated Generation and Filtering of Semgrep Rules from Vulnerability Patches

Static Analysis Security Testing (SAST) tools are essential for modern secure software development, yet the maintenance and creation of high-quality detection rules remain challenging and resource-int

2024

APR 15

Sparks of Digital Immortality with meraGPT

In an era where our digital footprints are as expansive as the internet itself, the concept of digital immortality is not just science fiction but a burgeoning reality. The introduction of meraGPT , t

2023

DEC 12

AutoFix: Automated Vulnerability Remediation using Static Analysis and LLMs

In the rapidly evolving world of software development, security remains a paramount concern. With the increasing complexity of applications and the ever-present threat of cyber attacks, developers and

2019

JUN 14

When the going gets tough: Understanding the challenges with Product commoditization in SCA

Recently, I have been thinking a lot about product commoditization and how it affects the software composition analysis (SCA) tools market. If you have been living under a rock and have never heard of

2017

DEC 29

The Most In-Demand Programming Languages of 2018

We saw several new programming languages like Kotlin, Rust, and Go lang come into promienence this year. In this article, we take a look at what 2018 has in store when it comes to programming language

DEC 21

Cyber Wars in 2018

This year we saw a number cyber attacks like WannaCry and Petya aimed at causing disruptions and damage to organizations and nations. In this article, we take a look at what is in store for us in 2018

DEC 13

Is the World Ready for the New Generation of Self-Propagating Ransomware?

Self-propagating threats such as WannaCry and Petya were only the tips of the iceberg. The success hackers enjoyed with WannaCry and Petya makes it quite likely others will try to replicate the tactic

DEC 07

The Impact of DevOps on Application Performance Management

Application Performance Mangement or APM refers to the practice of monitoring the performance of your code, application, runtimes, and overall user experience. In this article, we will talk about how

NOV 22

What are the top 3 free security tools that every infosec professional should use?

There are several free tools that a security engineer may use as part of their arsenal but the following three are quite essential.

NOV 12

Companies Lax on Open Source Risk

Recently, a survey done on open source risk found that enterprises are not proactive in managing and securing the use open source. Almost 40% of respondants said that no one in their company was respo

SEP 18

5 Steps Towards GDPR Compliance

On 25th May 2018 the EU General Data Protection Regulation (GDPR) will become enforceable. It will change how businesses and public sector organizations can handle information of customers and users.

MAR 25

Protecting Spring Boot Apps with Botwall4J

Botwall4J is an open-source library that can help protect Java web applications from bots, content scrapers and automated account hijacking attempts. In this article, we will see how simple it is to i

MAR 24

Continuous fuzzing of Java projects with GramTest

GramTest is a Java-based tool that allows you to generate random test cases based on BNF grammars. It is an open-source project and can be downloaded from GitHub . In this article, we will see how you

JAN 08

Lambda Security is up and running!

I have always been interested in the interplay between programming languages and software security. In particular, isn't it nice that there are class of vulnerabilities that can be eliminated by desig